CVE-2026-25193

HighCVSS 8.6/10Last modified Aug 17, 2026

Description

Insertion of Sensitive Information into Log File (CWE-532) in some Command Centre Service installers could lead to Service Account credentials exposure.  Mitigating Factor: Only sites that install Command Centre Services with a custom Service Account (not the default Network Service account) are potentially impacted.

Mitigation: For sites concerned about exposure, the recommended action is to change the Service Account password. They can also delete any installer log files, usually found in %programdata%\Gallagher\Command Centre.

Metrics

CVSS 3.1 8.6/10CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:C/C:H/I:H/A:H

Weakness enumeration

CWE-532

Affected software

No affected versions have been published.

Timeline

Published
May 25, 2026
Last modified
Aug 17, 2026
NVD status
Analyzed

Related CVEs from 2026

CVE-2026-251941.8Out-of-bounds write in the firmware for the Intel(R) Slim Bootloader may allow a denial of service. System software adversary with a privileCVE-2026-251956.6An OS command injection vulnerability exists in XWEB Pro version 1.12.1 and prior, enabling an authenticated attacker to achieve remoteCVE-2026-251968.8An OS command injection vulnerability exists in XWEB Pro version 1.12.1 and prior, enabling an authenticated attacker to achieve remote coCVE-2026-251978.1A specific endpoint allows authenticated users to pivot to other user profiles by modifying the id number in the API call.CVE-2026-251985.1web2py versions 2.27.1-stable+timestamp.2023.11.16.08.03.57 and prior contain an open redirect vulnerability. If this vulnerability is exploCVE-2026-251999.1Instances deployed via the Proxmox extension allow unauthorized access to instances belonging to other tenants. This issue affects ApachCVE-2026-25205.4The Online Scheduling and Appointment Booking System – Bookly plugin for WordPress is vulnerable to unauthorized modification of data due toCVE-2026-252009.8A vulnerability in MagicInfo9 Server allows authorized users to upload HTML files without authentication, leading to Stored XSS, which can rCVE-2026-252018.8An unauthenticated user can upload arbitrary files to execute remote code, leading to privilege escalation in MagicInfo9 Server. This issue CVE-2026-252029.8The database account and password are hardcoded, allowing login with the account to manipulate the database in MagicInfo9 Server.This issue CVE-2026-252037.8Samsung MagicINFO 9 Server Incorrect Default Permissions Local Privilege Escalation Vulnerability This issue affects MagicINFO 9 Server: lCVE-2026-252047.5Deserialization of untrusted data vulnerability in Samsung Open Source Escargot Java Script allows denial of service condition via process a